Two-factor authentication (2FA)

The two factors must be different kinds of thing: something you know (a password or PIN), something you have (a phone, an app or a security key) or something you are (a fingerprint or face). Two passwords are not two factors. The point is that a stolen password alone is no longer enough to get in.

2FA is a type of multi-factor authentication (MFA), which allows two or more factors. The terms are often used interchangeably. Passkeys, a sign-in method designed to replace passwords, combine a device you hold with a fingerprint, face or PIN, and many services count them as meeting the same goal.

How it works

You turn on 2FA in an account's security settings and choose a second factor. The service then asks for it every time you log in from a new device or browser, or periodically. The common options, from weakest to strongest, are codes sent by SMS, codes from an authenticator app, push approvals in an app (stronger when you must type a number shown on screen), and hardware security keys or passkeys.

Authenticator apps generate a six-digit code from a shared secret and the current time, changing every 30 seconds, so the code works offline and cannot be intercepted on the phone network. SMS codes are better than nothing but can be stolen through SIM swapping, where an attacker persuades a mobile operator to move your number to their SIM. Security keys and passkeys are resistant to phishing, because they only respond to the genuine website's address.

When you enable 2FA, the service usually gives you backup codes: single-use codes for when your phone is lost. Store them safely, for example in a password manager or printed in a secure place. Without them, account recovery can take days or fail completely.

Example

A bookkeeper's email password is exposed when an unrelated shopping site she once used is breached. An attacker tries it on her email account from another country. Because she uses an authenticator app for 2FA, the login stops at the code screen, and she receives an alert about a sign-in attempt. She changes the password and loses nothing.

Her colleague, who uses SMS 2FA, later receives a fake "delivery problem" text with a login page that asks for his password and then the code. He enters both and the attacker uses them at once. After that, the office moves its email and accounting accounts to security keys for the most important logins.

Why it matters for your business

Taking over an email, domain, hosting or bank account is one of the most damaging things that can happen to a small business, and stolen or reused passwords are a common route in. 2FA blocks most of these attempts at almost no cost; the trade-off is a few seconds per login and a recovery plan for lost devices. Start with the accounts that control everything else: email, domain registrar, hosting, website admin, payment provider and social media. Many services let administrators require 2FA for every staff member, which is worth turning on. You can check your accounts' security pages to see which have it enabled.

Common mistakes

• Enabling 2FA on minor accounts but not on email, which can be used to reset the passwords of everything else.
• Not saving backup codes, then losing access when a phone breaks or is replaced.
• Linking a shared business account to one employee's personal phone, which causes a lockout when they leave.
• Assuming SMS codes stop phishing, when a fake login page can ask for the code and use it immediately.

Questions people ask

Is SMS two-factor authentication safe?

It is much safer than a password alone, but the weakest form of 2FA. SMS codes can be stolen through SIM swapping or entered by the user into a fake login page. Use an authenticator app, a passkey or a security key wherever the service supports it.

What happens if I lose my phone with 2FA on it?

Use the backup codes you saved when you set up 2FA, or another registered method such as a second security key. Without these, you must go through the service's account recovery process, which can be slow. Always register a backup method.

What is the difference between 2FA and MFA?

Two-factor authentication uses exactly two factors, such as a password and a phone code. Multi-factor authentication means two or more factors. In everyday use the terms mean almost the same thing, and both aim to stop a stolen password from being enough.